Skip to main content

Defender for SQL on machines and Azure SQL

Microsoft documentedDefender for SQL · Source checked 2026-10-22 · Not yet verified in tenant · Sources: [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25]

What it is​

Defender for SQL is two separate plans inside the Databases plan of Defender for Cloud. They share a feature set but protect different resources and bill differently.

PlanPricing nameProtects
Defender for Azure SQL DatabasesSqlServersAzure SQL Database (single and elastic pool), Azure SQL Managed Instance, Azure Synapse Analytics dedicated SQL pools. Read and write replicas.
Defender for SQL Servers on MachinesSqlServerVirtualMachinesSQL Server 2012 through 2022 on Azure VMs, SQL Server enabled by Azure Arc on-prem or in AWS and GCP.

Both plans give two things. Vulnerability assessment (VA) scans the engine and databases against a Microsoft rule set and reports misconfigurations, excessive permissions and unprotected sensitive data, with remediation scripts where they exist. Advanced Threat Protection (ATP) watches activity for SQL injection, brute force, anomalous access and suspicious payloads, and raises Defender for Cloud alerts.

Defender for Servers protects the operating system. Defender for SQL protects the engine on top of it. They are separate pricings on Microsoft.Security/pricings and both can be Standard on the same subscription. Learn does not spell out any overlap or discount between them.

Naming trap: the portal shows one Databases plan with four resource types under Select types. The two SQL types are the two plans above.

Licensing and prerequisites​

  • Each plan is priced separately. Defender for SQL Servers on Machines is billed per server, not per database. For the Azure SQL plan Learn points to the pricing page and cost calculator without stating the unit. Express VA configuration adds no cost. See licensing.
  • Enabling the Azure SQL plan at subscription level turns on ATP and VA with express configuration for every Azure SQL database in that subscription, including ones created later.
  • SQL on machines: Subscription Owner to deploy the plan, because it deploys Azure Policy. The SQL Server service account must hold the sysadmin fixed server role on each instance (the default). The plan impersonates that account to reach the instance.
  • SQL on machines: SQL Server 2012 (11.x) or later, Windows Server 2012 R2 or later. On-prem machines must be onboarded to Azure Arc first and registered as Arc SQL Server instances. See onboarding.
  • SQL on machines network: outbound HTTPS on TCP 443 with TLS 1.2 or later to *.<region>.arcdataservices.com, plus the normal Arc URL list.
  • SQL on machines extensions that Azure Policy must not block:
ExtensionPublisherTypeScope
Defender for SQLMicrosoft.Azure.AzureDefenderForSQLAdvancedThreatProtection.WindowsAzure VM and Arc
SQL IaaS ExtensionMicrosoft.SqlServer.ManagementSqlIaaSAgentAzure VM
Azure extension for SQL ServerMicrosoft.AzureDataWindowsAgent.SqlServerArc
  • VA permissions (express): Security Admin or Security Reader to see results in recommendations. SQL Security Manager or Security Admin to change VA settings and to open resource-level results. Classic additionally needs Storage Blob Data Reader and Owner on the storage account.
  • VA on machines needs EXECUTE on xp_instance_regread and sysmail_help_profile_sp for some rules.
  • Linux: the Arc SQL page says Defender for Cloud works only for SQL Server on Windows machines. The extension type is Windows-only. Treat SQL Server on Linux as unsupported until Learn says otherwise.
  • Arc SQL instances with the Arc proxy feature enabled are not supported.

How it works​

The two plans have different data paths.

Azure SQL plan: no agent. ATP runs in the platform and raises alerts into Defender for Cloud and by email. VA express stores scan results in Microsoft-managed storage in the region of the logical server. Managed Instance express depends on the instance's system-assigned managed identity. Classic VA stored results in a storage account you own, scheduled scans could be turned off, and baselines needed a rescan.

SQL on machines plan: since the April 2025 enhanced agent, the plan no longer needs the Azure Monitor Agent. On an Azure VM the SQL IaaS Agent extension registers the instance. On an Arc server the Azure extension for SQL Server registers it. Defender for Cloud then creates a system-assigned managed identity on the host if no user-assigned one exists, and installs the Defender for SQL extension. Detection is split: an Extended Events session named SQLAdvancedThreatProtectionTraffic runs on the machine (SQL 2017 and later; older versions read the audit log), and the rest runs in the cloud. Microsoft quotes about 3 percent CPU at peak slices and about 30 minutes for protection status to update once prerequisites are met.

Where the Log Analytics workspace still matters: the VA on machines page says scan results live in the region of the workspace the machine is connected to, data is collected only when SQL VA is enabled on that workspace, and changing the plan's workspace resets scan results and baselines (recoverable within 90 days if you switch back). The autoprovisioning page describes the SQL-targeted AMA process as the MMA replacement and is now marked government-cloud only. Learn does not name the SQL data collection rule. TODO: confirm in the dev tenant whether an AMA DCR is still created with the enhanced agent.

VA scheduling differs by plan. Express on Azure SQL: recurring scans always on, each database gets a random slot on a fixed weekday, on-demand scans allowed. SQL on machines: every 12 hours per Learn's VA page, read-only, seconds per database. The Arc SQL page says first scan within 24 hours then every Sunday. The numbers disagree; expect 12 hours with the current agent and verify.

Baselines: express lets you baseline a batch of rules, the latest scan, or a single rule, and it applies without a rescan. Classic was single rule and needed a rescan. On machines, Add all results as baseline on the recommendation does the same, and a new baseline replaces the old one.

ATP alert families, from the SQL alerts reference. Type IDs follow SQL.<DB|VM|MI|DW>_<Name> and Synapse.SQLPool_<Name>.

AlertTacticSeverity
A possible vulnerability to SQL InjectionPre-AttackMedium
Potential SQL injectionPre-AttackHigh
Suspected brute force attack, with valid user, or successfulPre-AttackHigh
Logon activity from a potentially harmful applicationPre-AttackHigh
Login from a suspicious IPPre-AttackMedium
Log on from an unusual Azure Data Center or unusual locationProbing or ExploitationInformational
Login from a principal user or domain not seen in 60 daysExploitationInformational
SQL Server potentially spawned a Windows command shell and accessed an abnormal external sourceExecutionHigh or Medium
Unusual payload with obfuscated parts initiated by SQL ServerExecutionHigh or Medium
An abnormally large number of rows were extracted (Preview, VM only, extension 2.0.3448.357 or later)ExfiltrationMedium

The classic VA and ATP APIs (vulnerabilityAssessments, securityAlertPolicies/Default on the SQL resource provider) retire on 16 August 2027. New work should use the unified Microsoft.Security/sqlVulnerabilityAssessments API at version 2026-04-01-preview and advancedThreatProtectionSettings/Default for ATP.

Configure​

  1. Defender for Cloud > Environment settings > subscription > Defender plans. On the Databases row choose Select types. Turn on Azure SQL Databases and SQL Servers on Machines as needed. Continue, then Save. For an AWS or GCP connector the toggle is under Settings on the Databases plan.
Defender plans page, the Databases row with Select types. Source: Microsoft Learn, CC BY 4.0.
Defender plans page, the Databases row with Select types. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
Resource types pane with SQL Servers on Machines set to On. Source: Microsoft Learn, CC BY 4.0.
Resource types pane with SQL Servers on Machines set to On. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

  1. If the subscription had the machines plan before 21 April 2025, the Databases plan shows Action required or an Update button. Open Settings and select Update so the plan moves to the enhanced agent and auto-registers SQL instances. The Overview page also has a multi-subscription update link.

  2. Resource-level enablement for the machines plan is only for when you do not want the whole subscription covered. Disable the plan at subscription level first, then open SQL virtual machines or Azure Arc > Data services > SQL Server instances, pick the instance, Security > Microsoft Defender for Cloud, Enable Microsoft Defender for SQL servers on Machines.

Per-resource enable button on a SQL VM or Arc SQL instance. Source: Microsoft Learn, CC BY 4.0.
Per-resource enable button on a SQL VM or Arc SQL instance. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

  1. Arc-enabled SQL Server: connect the Windows machine to Arc and let the Azure extension for SQL Server register the instance. The Arc SQL Learn page still describes creating a Log Analytics workspace and adding the Log Analytics Agent extension. That is the retired MMA path. With the enhanced agent the registration step is what matters. On the Arc SQL resource, the Microsoft Defender for Cloud tile shows Enablement Status; if it says Disabled at the subscription-level, go back to step 1.

  2. Express VA on an Azure SQL server: open the logical server or database, Security > Defender for Cloud. If VA is not configured, select Enable in the notice, or Configure then Enable, and confirm. If it is on classic, the same place shows a migrate notice. Baselines and scan history do not migrate.

Enable notice for express VA configuration in the Defender for Cloud pane of an Azure SQL resource. Source: Microsoft Learn, CC BY 4.0.
Enable notice for express VA configuration in the Defender for Cloud pane of an Azure SQL resource. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Baselines on machines: Recommendations > Vulnerability assessment findings on your SQL servers on machines should be remediated > Manage query results and remediation, or Add all results as baseline.
SQL VA recommendation with Manage query results and remediation and Add all results as baseline. Source: Microsoft Learn, CC BY 4.0.
SQL VA recommendation with Manage query results and remediation and Add all results as baseline. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Optional: disable specific VA findings by scope with Disable rule on the recommendation (preview). Needs Azure Policy edit rights and takes up to 24 hours.

Verify​

  • Machines plan, whole subscription: Recommendations > The status of Microsoft SQL Servers on Machines should be protected > View recommendation for all resources. Each SQL VM and Arc SQL instance shows a protection status and an unhealthy reason. Refreshes every 12 hours.
  • Machines plan, one resource: SQL virtual machines or SQL Server - Azure Arc > resource > Security > Defender for Cloud. Protection status should read Protected. This view is live.
Protection status Protected on a single SQL VM or Arc SQL resource. Source: Microsoft Learn, CC BY 4.0.
Protection status Protected on a single SQL VM or Arc SQL resource. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  • Extension state: VM or Arc server > Settings > Extensions + applications > Defender for SQL extension. With several instances on one host this is the only place that shows per-instance status.
  • VA results: Defender for Cloud VA dashboard, the resource's Defender for Cloud page, the Vulnerability Assessment Findings workbook, or continuous export to Log Analytics or Event Hubs. On Azure SQL, Scan History on the resource shows the last scan whose results changed; express does not store identical results.
  • Check which VA model a server is on: resource > Defender for Cloud > Configure under Enablement Status. If it offers a storage account you are on classic.
  • Test alerts on machines: Azure SQL > SQL Server on Azure VMs or SQL Server instances (Azure Arc) > resource > Security > Microsoft Defender for Cloud > Security Alerts tab > Simulate Alerts. Choose brute force, suspicious application, SQL injection, principal anomaly, shell external source or shell obfuscation. Credential scenarios need SQL authentication and a test login. The alert appears in a few minutes; use Check for alerts on this resource in Microsoft Defender for Cloud. Needs Security Admin or Contributor, plus rights to write VM extensions and deployments.
Security Alerts tab with the Simulate Alerts button on a SQL VM. Source: Microsoft Learn, CC BY 4.0.
Security Alerts tab with the Simulate Alerts button on a SQL VM. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  • Azure SQL ATP: the Sample alerts button in Security alerts is the generic Defender for Cloud path. Learn's SQL pages do not document a sample alert specific to Azure SQL Database. TODO: confirm in the dev tenant that Sample alerts offers the SQL plan.

Resource Graph sketch for inventory (not from Learn, confirm field names):

resources
| where type in~ ('microsoft.sqlvirtualmachine/sqlvirtualmachines','microsoft.azurearcdata/sqlserverinstances')
| project name, type, resourceGroup, subscriptionId, location

Troubleshoot​

Defender for SQL extension detail pane with per-instance status messages. Source: Microsoft Learn, CC BY 4.0.
Defender for SQL extension detail pane with per-instance status messages. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
SymptomLikely causeFix
SQL VM or Arc SQL missing from the protection recommendationInstance not registered in Azure. SQL IaaS Agent extension or Azure extension for SQL Server not deployed, or auto-registration offRegister the instance. Arc: connect the server and let the SQL extension auto-deploy. Azure VM: register with the SQL IaaS Agent extension.
Unhealthy reason Missing identityHost has no managed identityAdd a system-assigned or user-assigned identity. No RBAC role needed.
Unhealthy reason Defender for SQL extension does not existAzure Policy deny on publisher Microsoft.Azure.AzureDefenderForSQL type AdvancedThreatProtection.Windows, or deployment never ranRemove the deny, or install with Set-AzVMExtension version 2.x.
Unhealthy reason Lack of permissionsSQL service account is not sysadminGrant it, or follow the least privilege article for Arc.
Unhealthy reason Lack of communicationOutbound 443 to *.<region>.arcdataservices.com blockedOpen it with TLS 1.2 or later.
Unhealthy reason SQL Server restart is neededExtension install needs the engine to restartRestart the instance in a window.
Several instances on one VM, recommendation unclearRecommendation is per hostOpen the Defender for SQL extension pane for per-instance reasons.
Plan shows Action required or UpdateSubscription enabled before 2025-04-21, still on the old AMA configurationSettings > Update, then re-verify protection.
Old MMA path, Log Analytics agent toggle still onLegacy autoprovisioningTurn on Azure Monitoring Agent for SQL server on machines first, then turn off the Log Analytics agent toggle. Check Defender for Servers dependencies before you do.
VA results and baselines vanished on machinesPlan's Log Analytics workspace was changedRevert to the original workspace within 90 days to recover.
VA rule shows Not applicable, cannot baselineRule output exceeded the 1 MB per-rule cap, or the finding was disabledExpected. Disabled findings also land under Not applicable.
Some VA rules fail on machinesScanner lacks EXECUTE on xp_instance_regread or sysmail_help_profile_spGrant EXECUTE.
SQL servers should have vulnerability assessment configured stays unhealthy on classicServer has no user databases, so classic never scans system databasesMove to express.
Exemption saved but no effectAzure CSPM standard not assigned to the scopeAssign it.
Arc SQL instance behind Arc proxy not protectedArc proxy feature not supported by the planKnown limitation.
Simulate Alerts failsMachine not Protected, plan off, or no SQL authentication for credential scenariosFix protection first, enable SQL auth with a test login.

Gotchas and limits​

  • Plan naming. Two plans, one Databases toggle, three names each across the portal, Learn and the pricing API (SqlServers and SqlServerVirtualMachines). Scripts that enable Databases must set both pricings.
  • Billing moved. The enhanced agent can discover instances the AMA path missed. Microsoft warns the bill may rise after the upgrade. Billing is per server for the machines plan.
  • Defender for Servers is a separate pricing. Turning on VirtualMachines P2 does not protect the SQL engine, and SqlServerVirtualMachines does not give you MDE on the host. Run both on SQL hosts.
  • Managed Instance. Express VA depends on the system-assigned managed identity. ATP on the new API needs api-version=2023-08-01; the 2021-11-01-preview version returns NoRegisteredProviderFound for MI. Synapse ATP has no new API yet and still writes to the retiring securityAlertPolicies resource.
  • Express replaces the storage account. You lose direct access to raw results and baselines, Excel export becomes CSV, the built-in weekly email is gone (use Logic Apps), policy scope drops to subscription and server, and single-rule output caps at 1 MB. Express is the default for every new supported Azure SQL database and Microsoft is rolling out automatic express enablement at subscription level where the Azure SQL plan is on.
  • Classic API retirement 2027-08-16 covers VA and ATP settings on Microsoft.Sql. Audit with the scripts on the migration page.
  • AMA cost. On the legacy path, AMA shipped SQL data to a Log Analytics workspace and you paid ingestion. The enhanced agent removes AMA for this plan, but the VA page still ties result storage and residency to the workspace region. Keep the workspace in the same region as the servers and do not casually change it.
  • Linux. Learn says Windows only. The extension type is AdvancedThreatProtection.Windows and Arc least privilege is not supported on Linux either. No workaround documented.
  • Arc proxy feature is unsupported. Government cloud got the enhanced agent GA on 2026-09-29, later than commercial.
  • Status lag. The protection recommendation refreshes every 12 hours, the per-resource page is live. Disable rule changes take up to 24 hours. First VA results wait for the scheduled slot unless you trigger a scan.
  • Database-level VA recommendations went GA on 2026-07-26 and count toward Cloud Score, not the classic secure score. Dashboards built on the old aggregated recommendation names will drift.

Further reading​

Only three posts from the last year qualified as practitioner sources; most hits were Learn mirrors.

My notes​

TODO: Sohail's notes after verification.

Changelog​

DateChangeSource
2026-10-22Drafted from Learn, with Learn images and diagrams[1]